=== Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)  ===
Contributors: hesseldejong, RogierLankhorst, sh4lin, parthnvaswani
Donate link: paypal.me/Burststatistics
Tags: analytics, visitor tracking, statistics, google analytics, cookieless analytics
Requires at least: 6.6
License: GPL2
Requires PHP: 8.0
Tested up to: 7.2
Stable tag: 3.6.3

Simple, lightweight WordPress analytics with privacy-friendly visitor tracking. Cookieless and GDPR-ready. Setup in seconds, no cookie banner needed.
 
== Description ==
 
= Finally, WordPress analytics you'll actually use =
 
Google Analytics is overkill. Most other WordPress statistics plugins are cluttered and confusing. You just want to track visitors and know what's happening on your site, without a data science degree.
 
[Burst Statistics](https://burst-statistics.com/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=intro) gives you a clean, intuitive analytics dashboard focused on the metrics that actually matter. **No external analytics accounts. No complex setup. Install, activate, and understand your website traffic in seconds.**
 
Trusted by **200,000+ WordPress sites**. Built by the team behind [Team Updraft](https://teamupdraft.com/), known for [UpdraftPlus](https://wordpress.org/plugins/updraftplus/), [WP-Optimize](https://wordpress.org/plugins/wp-optimize/), and [All-In-One Security (AIOS)](https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/).
 
= What our users are saying =
 
> "Finally, an analytics plugin I can actually explain to clients."
> &mdash; @anguskeystone on wordpress.org
 
> "I tried WP Statistics and Independent Analytics, but they're overloaded and confusing. Burst's UI is intuitive and focused on what matters to me."
> &mdash; @vallered on wordpress.org
 
= Why Burst Statistics? =
 
**Analytics designed to be actionable**
Other analytics plugins throw everything at you. Burst shows what matters, visitors, pageviews, referrers, top pages, in a dashboard you'll actually use. No data overload. No confusing menus. See why [Burst is perfect for bloggers](https://burst-statistics.com/for/bloggers/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=why-actionable).
 
**Privacy analytics by design**
All site stats stay on your server, making Burst a true local analytics solution. No external tracking. Your data is yours, we never see it without your explicit permission. Designed for GDPR compliant analytics out of the box. Read [why Burst Statistics is privacy-friendly](https://burst-statistics.com/why-is-burst-privacy-friendly/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=why-privacy).
 
**Zero setup friction**
Install, activate, done. No Google Analytics account, no GA4 setup, no tracking codes, no configuration headaches. Start seeing live visitors immediately. New to analytics? Start with our guide on [WordPress analytics](https://burst-statistics.com/guides/wordpress-analytics/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=why-setup).
 
**WordPress-native analytics**
Not a port from another platform. Built specifically for WordPress with native performance and seamless integration. Works with WooCommerce, blogs, business sites and membership sites.
 
**Lightweight analytics, fast by default**
Optimized database queries. A tiny tracking script under 4 KB. No external dependencies slowing down your pages. Designed to track accurately even when using aggressive server-side caching. See the proof in [does Burst slow down my website](https://burst-statistics.com/guides/does-burst-statistics-slow-down-my-website/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=why-speed).
 
= Features =
 
**Understand your website traffic**
 
* Top performing pages and posts at a glance
* Track key metrics: visitors, sessions, pageviews, bounce rate
* Breakdown of visitors by device (desktop, tablet, mobile)
* Filter data by custom date ranges
* Compare traffic between periods
* Search Console integration, view Google searches right on your dashboard

**Real-time analytics**
 
* Identify the real-time source for live visitors
* See the specific pages users are visiting now
* Live count of active users on your site
 
**See what content performs**
 
* Top pages and posts ranked by views
* Compare any date range
* Track individual page performance
 
**Custom conversion and goal tracking**
 
* Track views, clicks and WordPress hooks
* Track WooCommerce analytics & sales (Burst Pro Business)
* Track custom events and conversions
* Step-by-step setup in our [goals guide](https://burst-statistics.com/guides/how-to-set-goals/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=feature-goals)
 
**Privacy-friendly analytics without compromise**
 
* 100% self-hosted, all statistics stored locally in your WordPress database
* [Cookieless tracking](https://burst-statistics.com/features/cookieless-tracking/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=feature-cookieless) option, a cookie free analytics setup with no consent banner required in many countries
* Analytics designed to support GDPR, CCPA, DSGVO, AVG, RGPD and PECR compliance
* No data shared with Google, Facebook or any third party
 
**Stay informed**
 
* Weekly or monthly email reports delivered to your inbox
* Compare periods to spot trends
* Get notified when tracking does not work
 
= A WordPress-native Google Analytics alternative =
 
If you've outgrown Google Analytics, or never wanted GA4 in the first place, Burst is built for you. As a [Google Analytics alternative](https://burst-statistics.com/guides/google-analytics-alternative-why-burst-is-better-for-wordpress/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=ga-alternative-intro), Burst trades GA4's complexity for clarity. You get the metrics that matter on a single dashboard, without sampling, without data thresholding, and without sending your visitors through Google's ad network.
 
GA4 is built to make Google's ad business better. Burst is built to make your website better.
 
Curious about the full picture? Read [why WordPress site owners are leaving Google Analytics behind](https://burst-statistics.com/switch-from-google-analytics-wordpress/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=ga-switch-story) or the head-to-head [Burst Statistics vs Google Analytics](https://burst-statistics.com/burst-statistics-vs-google-analytics/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=ga-comparison).
 
= From the team behind UpdraftPlus, WP-Optimize and All-In-One Security =
 
Burst Statistics is part of [Team Updraft](https://teamupdraft.com/), the team behind some of the most installed WordPress plugins on the market:
 
* [UpdraftPlus - WP backup and migration plugin](https://wordpress.org/plugins/updraftplus/)
* [WP-Optimize - cache, image compression, minification and database cleanup](https://wordpress.org/plugins/wp-optimize/)
* [All-In-One Security (AIOS) - security and firewall](https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/)
 
= Who is Burst Statistics for? =
 
Burst works for any WordPress site, but we've built specific solutions for the four audiences who get the most out of it:
 
* **[Bloggers and content creators](https://burst-statistics.com/for/bloggers/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=audience-bloggers)**, see which posts resonate with your audience
* **[Entrepreneurs and small business owners](https://burst-statistics.com/for/entrepreneurs/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=audience-entrepreneurs)**, understand your traffic and campaigns without complexity
* **[WooCommerce stores](https://burst-statistics.com/for/woocommerce/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=audience-woocommerce)**, track visitor behavior, revenue and product performance
* **[Agencies and freelancers](https://burst-statistics.com/for/agencies/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=audience-agencies)**, manage analytics and reporting for multiple client sites
* **Privacy-conscious site owners**, GDPR compliant analytics without consent banners
* **Anyone tired of Google Analytics**, get clarity instead of confusion
 
= Free vs Pro =
 
**Burst Statistics (free)** includes everything you need to understand your website traffic. Visitors, pageviews, referrers, top content, device stats, goal tracking, email reports and more.
 
**Burst Pro** adds advanced features for businesses and professionals. [Compare all plans on the pricing page](https://burst-statistics.com/pricing/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=pricing-overview).
 
**CREATOR PLAN**
 
* [UTM campaign tracking](https://burst-statistics.com/features/utm-campaign-tracking/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=feature-utm), see which marketing efforts drive results
* [Geographic data](https://burst-statistics.com/features/geographic-insights/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=feature-geo), country and city-level visitor insights
* Advanced filtering, segment data by any dimension
* Data archiving settings, keep your database lean automatically
* Priority support, direct contact with our developers
 
**BUSINESS PLAN**
 
* Everything in the Creator plan, plus
* [Full WooCommerce sales dashboard](https://burst-statistics.com/features/revenue-sales-tracking/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=feature-woocommerce), see which content brings in the most revenue
* Revenue attribution, connect WooCommerce sales to traffic sources
 
**AGENCY PLAN**
 
* Everything in the Business plan, plus
* [Reporting](https://burst-statistics.com/features/automated-reporting-exports/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=feature-reporting), generate shareable performance reports for clients
 
All Burst Pro plans include **priority support**. You'll have direct contact with our developers, real humans, not a chatbot.
 
[**Upgrade to Burst Pro &rarr;**](https://burst-statistics.com/pricing/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=cta-pro-upgrade)
 
= How Burst compares to other WordPress analytics plugins =
 
We're often asked how Burst stacks up against other tools. Honest, short version:
 
* **Google Analytics / GA4**, GA4 is powerful but built for advertisers, not site owners. It's complex, applies sampling and thresholding to your numbers, and requires a cookie banner in most countries. Burst is a simpler, privacy-friendly GA4 alternative that shows real numbers without the setup. Read the [full comparison](https://burst-statistics.com/burst-statistics-vs-google-analytics/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=compare-ga4).
* **MonsterInsights**, MonsterInsights is a connector that pipes your data into Google Analytics. If you want a true MonsterInsights alternative that keeps data on your own site instead of sending it to Google, Burst is a better fit.
* **Independent Analytics**, a respectful competitor with a similar privacy-first, WordPress-native approach. Burst leans harder into actionable dashboards, deeper UTM and goal tracking, WooCommerce revenue analytics and Agency-tier reporting. Try both and pick the one that clicks.
* **Koko Analytics**, a clean, lightweight option that focuses on the basics. Burst goes further with goal tracking, real-time analytics, UTM campaigns, WooCommerce analytics and email reports.
* **WP Statistics**, a long-standing WordPress stats plugin with a lot of options. Many users find the interface cluttered. Burst focuses on a single, clear dashboard designed for clarity over feature count.
* **Matomo**, self-hostable and feature-rich, but heavier and more complex to run. Burst is the simpler, faster, fully WordPress-native option.
 
= Useful guides and resources =
 
Learn the metrics, fix common problems, get more out of your analytics. All free, all on burst-statistics.com.
 
**Getting started**
 
* [WordPress analytics and the metrics that actually matter](https://burst-statistics.com/guides/wordpress-analytics/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-wp-analytics)
* [How to install Burst Statistics from the WordPress Repository](https://burst-statistics.com/how-to-install-burst-statistics-from-the-wordpress-repository/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-install)
* [How to set up your first goal](https://burst-statistics.com/guides/how-to-set-goals/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-goals)
 
**Privacy and GDPR**
 
* [Why Burst Statistics is privacy-friendly](https://burst-statistics.com/why-is-burst-privacy-friendly/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-privacy)
* [How to configure your website without a cookie banner](https://burst-statistics.com/guides/how-to-configure-your-website-without-a-cookie-banner/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-no-banner)
* [How Burst tracks website visitors without cookies](https://burst-statistics.com/how-does-burst-track-website-visitors-without-cookies/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-cookieless)
 
**Metrics and data interpretation**
 
* [How to reduce bounce rate in WordPress](https://burst-statistics.com/guides/how-to-reduce-bounce-rate-in-wordpress/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-bounce-rate)
* [What is bounce rate?](https://burst-statistics.com/definition/what-is-bounce-rate/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-def-bounce)
* [What is a pageview?](https://burst-statistics.com/definition/what-is-a-pageview/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-def-pageview)
* [What is conversion rate?](https://burst-statistics.com/definition/what-is-conversion-rate/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-def-conversion)
 
**Campaigns and conversions**
 
* [How to track UTM (and Burst) parameters](https://burst-statistics.com/guides/how-to-track-utm-and-burst-parameters/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-utm)
* [Campaign URL builder](https://burst-statistics.com/campaign-url-builder/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-url-builder)
* [How to create and A/B test marketing campaigns with Burst](https://burst-statistics.com/guides/how-to-create-and-a-b-test-marketing-campaigns-with-burst/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-ab-test)
 
**WooCommerce**
 
* [10 proven ways to reduce WooCommerce cart abandonment](https://burst-statistics.com/guides/reduce-woocommerce-cart-abandonment/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-cart-abandonment)
* [Introducing sales analytics for WooCommerce in Burst Pro](https://burst-statistics.com/new-feature-woocommerce-insights/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-woo-feature)
 
Browse the full [Learn hub](https://burst-statistics.com/learn/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=learn-hub) for more.
 
= Installation =
 
1. Go to **Plugins &rarr; Add New** in your WordPress dashboard
2. Search for **Burst**
3. Click **Install Now**, then **Activate**
4. Visit **Statistics &rarr; Dashboard** to see your analytics
 
That's it. No external accounts. No tracking codes to paste. Burst starts collecting site stats immediately.
 
Prefer installing manually or via Composer? See [installing Burst Statistics with Composer](https://burst-statistics.com/installing-burst-statistics-with-composer/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=install-composer).

= Credits =

Country-level geographic data is provided by the MaxMind GeoLite2 database. This product includes GeoLite2 Data created by MaxMind, available from https://www.maxmind.com/.

== Frequently Asked Questions ==
 
= Is Burst Statistics really free? =
 
Yes. Burst Statistics is 100% free with no tracking limits. [Burst Pro](https://burst-statistics.com/pricing/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-free-pro) is optional for users who need advanced features like UTM tracking, revenue attribution, geographic data or client reporting. That's how we keep Burst Statistics free for most users.
 
= Where is the data stored? =
 
All statistics are stored in your own WordPress database. Unlike Google Analytics or cloud-based tools, we have zero access to your data. Your data never leaves your server, unless you manually opt in to share anonymous usage insights with us. Read more about [how Burst handles your data](https://burst-statistics.com/data-sovereignty-why-it-matters-and-how-burst-statistics-gives-you-control-over-your-data/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-data-sovereignty).
 
= Is Burst a good Google Analytics alternative? =
 
Yes. If you find GA4 too complex, or you're concerned about sending visitor data to Google, Burst is a clean replacement. You get the website traffic stats you actually need, visitors, referrers, top pages, conversions, without the overwhelm. Read our [Google Analytics alternative guide](https://burst-statistics.com/guides/google-analytics-alternative-why-burst-is-better-for-wordpress/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-ga-alternative) for the full comparison.
 
= Is Burst a good GA4 alternative? =
 
Yes. Burst was built as a privacy-friendly GA4 alternative for site owners who want clarity instead of complexity. No Google account, no tag manager, no cookie banner in most cases. See [why WordPress site owners are leaving Google Analytics behind](https://burst-statistics.com/switch-from-google-analytics-wordpress/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-ga4-alternative).
 
= Is Burst a MonsterInsights alternative? =
 
Yes. MonsterInsights connects your WordPress site to Google Analytics, so your data still flows to Google. Burst keeps everything on your own server, with its own dashboard inside WordPress. If you want analytics that don't depend on Google, Burst is the simpler MonsterInsights alternative.
 
= How is Burst different from WP Statistics, Independent Analytics or Koko Analytics? =
 
Burst focuses on clarity over quantity. While some other WordPress analytics plugins can feel cluttered, Burst's dashboard is designed to show you what matters without the noise. Independent Analytics is closest in spirit, with a shared privacy-first, WordPress-native approach. Burst differentiates with deeper UTM tracking, WooCommerce analytics and Agency-tier reporting. WP Statistics offers a wider feature set, but many users find it overwhelming. Koko Analytics is intentionally minimal, so it works well for very basic needs.
 
= How is Burst different from Matomo? =
 
Matomo tries to be a full Google Analytics replacement. Burst tries to be the clearest, most actionable WordPress analytics tool. If you want simplicity, fast setup and a native WordPress experience, Burst is the better fit. If you need granular configuration and a full GA-style feature set, Matomo may suit you better.
 
= Do I need an account? =
 
No, you don't need an account, no data is sent to another website.
 
= Is there a limit to the number of visitors I can track? =
 
No. The only limiting factor is your own database and server.
 
= Does Burst Statistics use cookies? =
 
There is an option to use [cookieless tracking](https://burst-statistics.com/features/cookieless-tracking/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-cookies-feature) if you prefer. By default, Burst uses cookies because they're more accurate and lightweight. Even with cookies, Burst remains privacy-friendly because all data is anonymous and stored on your server. Read more about [why cookies are misunderstood](https://burst-statistics.com/why-is-burst-privacy-friendly/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-cookies-misunderstood#misunderstood-cookies).
 
= What is cookieless tracking? =
 
Burst Statistics can be used without setting cookies or storing data in browsers. This can affect accuracy slightly, so a hybrid option with cookies after consent is also possible. See [how Burst tracks visitors without cookies](https://burst-statistics.com/how-does-burst-track-website-visitors-without-cookies/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-cookieless-how).
 
= Is Burst GDPR compliant? =
 
Burst is designed to support GDPR, CCPA, DSGVO, AVG, RGPD and PECR compliance. Data stays on your server, tracking is anonymous, and you can disable cookies entirely. For most setups, no consent banner is needed for analytics. See [how to configure your website without a cookie banner](https://burst-statistics.com/guides/how-to-configure-your-website-without-a-cookie-banner/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-gdpr).
 
= Can I use Burst alongside Google Analytics? =
 
Yes. Many users run both during a transition period, or keep GA4 for historical data while using Burst for daily insights. There's no conflict.
 
= Does Burst Statistics slow down my website? =
 
No. Burst is built for performance with optimized database queries, a minimal tracking script and a Turbo Mode if speed matters more than perfect accuracy. The full breakdown is in [does Burst Statistics slow down my website](https://burst-statistics.com/guides/does-burst-statistics-slow-down-my-website/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-speed).
 
= Does Burst work with WooCommerce? =
 
Yes. Basic pageview tracking works in the free version. For full WooCommerce analytics, revenue tracking, product performance and sales attribution, you'll need [Burst Pro Business](https://burst-statistics.com/for/woocommerce/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-woocommerce).
 
= How do I migrate from another analytics plugin? =
 
Install and activate Burst, it starts tracking immediately. Historical data from other plugins can't be imported, but you can run both side-by-side during a transition period.
 
= Is it possible to install Burst Statistics with Composer? =
 
Yes. Both the free and premium plugins can be managed with Composer. Read the [Composer installation guide](https://burst-statistics.com/installing-burst-statistics-with-composer/?utm_source=wordpress.org&utm_medium=readme&utm_campaign=burst-readme&utm_content=faq-composer) for more information.
 
= Can I give feedback about the plugin? =
 
We value your feedback. You can [submit a support request on the WordPress forums](https://wordpress.org/support/plugin/burst-statistics/), and we will respond promptly.
 

== Change log ==
= 3.6.3 =
* August 19th 2026
* New: tracking health monitoring: a daily check verifies that tracking still works; when a drop is detected, Burst collects diagnostics (security plugins blocking the REST API, .htaccess rules, consent plugins, endpoint reachability and recent plugin or setting changes) and emails the site administrator at most once per week.
* New: community benchmarks: with anonymous data sharing enabled, the dashboard compares your visitors, bounce rate, session duration, time on page and device split against anonymized community averages, including your percentile rank.
* New: visibility goals for all Gutenberg block types, smarter goal trigger selection for third-party button, link and CTA blocks, and a new burst_clickable_blocks filter for custom block support.
* New: pinned filters: pin your preferred dashboard filters as personal defaults.
* New: added an "Unknown" location type to the Locations datatable, and continent grouping now falls back to a country's continent when the raw continent code is missing.
* New: diagnostic logging for the Search Console integration, visible in Site Health, with sensitive values redacted and a 90-day retention.
* New: beta features setting to try out upcoming features early.
* Improvement: reduced query overhead for the pageviews and count metrics.
* Improvement: the Reading Engagement score is now calculated as a single weighted score based on estimated reading time, instead of exposing separate raw metrics.
* Improvement: mobile and responsive layout improvements for the reporting dashboard and the email report wizard.
* Improvement: the GeoIP Country database now refreshes monthly.
* Improvement: GeoIP database downloads are verified with a SHA-256 integrity check, skipped entirely when the remote database is unchanged, and retried with increasing backoff after failures.
* Improvement: moved feature toggles from Settings to a dedicated Features menu.
* Improvement: removed filter types that could no longer be created.
* Security: share-link viewers restricted to specific dashboard tabs could read data from non-shared tabs via the admin-ajax REST fallback, because the request body could override the requested route after authorization had run; authorization now runs against the final dispatched route, with independent permission checks in the underlying handlers as defense-in-depth, props Dipak Panchal.
* Security: hardened the public tracking endpoint against resource exhaustion: lookup values are resolved with targeted queries and unique indexes instead of loading entire lookup tables into memory, browser versions are normalized to a bounded set, and the number of completed goals per hit is capped, props Gaurang Maheta.
* Security: the Site Health debug report now redacts Search Console tokens and filters server variables through an allowlist.
* Fix: the burst_uid cookie is no longer created before statistics consent has been given via the WP Consent API.
* Fix: blocks marked as a Burst goal no longer cause attribute errors during server-side rendering in the block editor.
* Fix: the dashboard could become unclickable when an ad blocker or a missing stylesheet left an invisible dialog's scroll lock active; stuck scroll locks are now detected and released.
* Fix: capturing on-site search terms no longer causes a fatal error when a third-party plugin filters search results to a non-array value.
* Fix: the low-traffic auto-update filter no longer fatals when called with an unexpected update item type.
* Fix: resolved datatable overlay display issues, an overlap with ad blocker elements, and normalized z-index layering across the dashboard.

= 3.6.2 =
* July 21st 2026
* New: 404 tracking: hits on not-found pages are now tracked and shown in a new 404 pages block on the Engagement tab, while regular statistics exclude 404 hits.
* Improvement: database upgrades are now protected by an atomic upgrade lock, so concurrent requests can no longer run the same upgrade twice and fill debug.log with duplicate column warnings.
* Improvement: plugin icons on the Integrations page are only requested for plugins hosted on WordPress.org, preventing failed icon requests for premium integrations.
* Fix: with Ghost mode and combined scripts enabled, the tracking script could be silently dropped when the obfuscated filename was missing; script generation is now consistent, including improved e-commerce handling.
* Fix: enabling the headless setup now correctly enables and generates the combined tracking script file.
* Fix: date labels could show the wrong day in some time zones due to UTC parsing of date-only values.
* Fix: the insights graph falls back to automatic grouping when the selected date range is too small for the chosen interval.
* Fix: license activation links pointed to an incorrect settings URL.
* Fix: database query error on statistics.status when upgrading from versions before 3.6.1 due to missing column migration.
* Fix: salt generation on endpoint causing fatal error due to missing function.

= 3.6.1 =
* July 14th 2026
* New: Google Search Console integration: connect your Google account on the new Integrations settings page to see your top Google search queries in a new statistics block.
* New: Gutenberg support for goals: mark buttons, images and navigation links as a goal directly in the block editor, including a metadata migration for block goal/page linkage.
* New: privacy level setting to choose how Burst recognizes visitors (cookie, private mode or device fingerprint), with a matching onboarding step.
* New: use the country reported by edge/CDN headers as a fallback for country detection, props @knofte.
* Improvement: increased the goal limit from one to three goals.
* Improvement: inline search filtering in the Goals Overview dropdown.
* Improvement: filter out spam and injection probes from on-site search terms.
* Improvement: the monthly search-terms cleanup now only removes terms without results whose single occurrence is older than a month.
* Improvement: added an explanation for the automatically created burst_viewer user, and excluded it from user queries and author archives.
* Security: share-link authorization now resolves the endpoint from the dispatched REST route, so it cannot desync from the executed route via request parameters.
* Security: improved escaping in email report tables and removed duplicate escaping.
* Fix: leave non-filesystem session save paths (Redis, memcached) untouched instead of falling back to the uploads directory, props @knofte.

= 3.6.0.1 =
* July 2nd 2026
* Fix: cleaned up an unused Pro-only setting that remained on some free installs. This had no effect on tracking.

= 3.6.0 =
* July 1st 2026
* New: country-level geolocation (GeoIP country tracking).
* New: WordPress Search Terms block: see what your visitors are looking for on your site.
* New: "All goals" option in the dashboard Goals block.
* New: AI Chat model selector: select your preferred model.
* New: WP Consent API notice task that detects whether the Consent API is active.
* Improvement: redesigned, unified tooltips with theme-consistent styling, high-contrast borders and improved readability.
* Improvement: rows-per-page selection is now persisted per datatable.
* Improvement: query and database performance improvements.
* Improvement: updated bundled libraries.
* Fix: prevent errors caused by the external link tracking class loading on the free plugin, props @dragon013.
* Fix: check open_basedir restrictions on the session save path to prevent warnings, props @jstark55.
* Fix: date picker and Reading Engagement UI layout, stacking, overflow and scroll-lock issues on mobile and tablet.
* Fix: browser detection cleanup.
* Fix: stricter match on AI plugins in REST API optimizer to prevent loading plugins only based on 'ai' string in slug, props @nicolas-cuny.
* Fix: first hit is no longer missed when Ghost mode and Turbo mode are combined.

= 3.5.1 =
* June 17th 2026
* New: Reading Engagement statistics block.
* New: Pro forms tracking.
* New: Custom CSS block.
* Improvement: store product IDs as integers in the ecommerce cart and order tables for smaller, faster joins.
* Improvement: use native date types and right-sized columns for the report tables.
* Improvement: removed duplicate database indexes on the subscription, orders and report tables to speed up inserts and updates.
* Improvement: added outgoing links, search terms, and forms to the Abilities API.
* Improvement: query data performance and accuracy improvements.
* Improvement: overwrite the free plugin's tracking script with the premium version during upgrade.
* Improvement: more robust report email delivery.
* Fix: container queries and various UI/UX improvements.
* Fix: mobile responsiveness for the funnel.
* Fix: report localization, adding locale handling in report configuration and formatting.
* Fix: use ISO-8601 weekday numbers so report scheduling does not break on other locales.
* Fix: generalize the GeoIP database type check to support commercial GeoIP2-City databases without triggering mismatch overwrites.

= 3.5.0 =
* June 3rd 2026
* Improvement: AI chat availability checks and ability registration, preventing PHP notices and duplicate ability registrations.
* Fix: AI Chat integration with AI plugin.
* Fix: missing GROUP BY in a statistics query.

= 3.4.3 =
* May 20th 2026
* Fix: AI chat enablement and MainWP integration reminder tasks can now be dismissed permanently.
* Fix: AI chat assistant is now hidden for users without the manage_burst_statistics capability.
* Fix: modal position calculation in the shared viewer.
* Fix: scope application password auth probing to Burst REST endpoints, so authentication on unrelated REST routes (e.g. WooCommerce) is no longer affected.
* Security: harden rest api optimizer, Props Sanjay Singh Jhala.
* Improvement: performance of background aggregated table build, time out guards on sql queries, additional indexes on the burst_statistics table.
* Improvement: AI chat enablement task now links to the "Ask Burst anything" setup guide.

= 3.4.2 =
* May 12th 2026
* New: AI chat integration via the WordPress Abilities API, including granular datatable abilities with metric allow-listing for pages, parameters, referrers, countries, campaigns, sales and subscription products.
* New: granular datatable REST endpoints (data/datatable/{id} and data/ecommerce/datatable/{id}) so the dashboard and AI abilities can request a specific table by id.
* Improvement: refactor the Share class into dedicated Share_Tokens, Share_Routing, Share_Auth and Share_UI services for clearer responsibilities and easier maintenance.
* Improvement: dark mode initialization respects an explicit "light" preference so users on a dark OS no longer briefly see a dark skeleton when they have forced light mode.
* Improvement: upgrade routine corrects the stored activation time for sites with older data.
* Improvement: replace native checkboxes with Radix checkboxes in the Share dialog for consistent styling.
* Improvement: shared-link capability checks now reflect the currently requested dashboard tab instead of a single cached value, so per-tab permissions are enforced correctly during batch REST requests.
* Fix: dashboard route returns a 404 when the user is not allowed to load it, instead of rendering an empty page.
* Security: limit Share link viewer statistics access, props Sanjay Singh Jhala.
* Security: REST API optimizer now matches the Burst namespace strictly against the URL path (anchored at burst/v1), props Sanjay Singh Jhala.
* Security: harden MainWP proxy authentication. Props Sanjay Singh Jhala, Chloe Chamberland & PRISM - Wordfence
* Security: Auto Installer now requires the install_plugins capability instead of activate_plugins and only accepts download URLs from official Burst hosts. Props Sanjay Singh Jhala.

= 3.4.1.1 =
* May 5th 2026
* Fix: CSS styling regression due to obsolete javascript files being included in the dashboard build.

= 3.4.1 =
* April 29th 2026
* New: automated tests for subscription statistics dashboard.
* New: abilities API integration.
* Improvement: move plugin activation logic to bootstrap class.
* Improvement: split ajax fallback logic into do_action and get_action.
* Fix: broken upgrade url in report settings.
* Fix: When both Story report and share links are generated, the UX could generate an error.
* Security: increase minimum required capability from view to manage in get_posts endpoint, Props Sanjay Singh Jhala.
* Security: hardened MainWP proxy authentication and CORS origin validation, Props Sanjay Singh Jhala.

= 3.4.0 =
* April 22nd 2026
* New: dark mode support for the Burst Statistics dashboard.
* New: support for MainWP integration.
* New: all time date range for datepicker selection.
* New: support for application passwords. It is now possible to use the Burst Rest API endpoints with application passwords.
* Improvement: add detection for ad blockers. If an ad blocker breaks the Burst dashboard, show a warning about this.
* Improvement: PHP warning about not existing referrers table when clearing the table.
* Fix: restore bounces filter, allowing overriding the default time used to decide if a visit is a bounce.
* Fix: fixed a bug in the visitor calculation for referrers, caused by changes for the "exclude" option in filters, props @bikew1se.
* Fix: Share links sessions are now cleaned up daily, to prevent extended access to the link for longer than the set expiration time, Props Sanjay Singh Jhala.
* Security: ajax fallback for get_reports endpoint unintentionally allowed users with burst_view capability to see reports configuration, props Sanjay Singh Jhala.

= 3.3.0 =
* April 1st 2026
* New: Time per session filter, allowing filtering by visit duration.
* New: Dark mode support for email reports.
* Improvement: Move columns from statistics to sessions table, reducing data storage and improving query performance.
* Improvement: Session data included in archive CSV exports.
* Improvement: Add missing database indexes for improved performance.
* Security: Share link viewers could view report data (recipient email addresses, scheduling configuration). Props Sanjay Singh Jhala.
* Security: Share link viewers could view ecommerce/sales data, even when the share link was scoped to non-sales tabs only. Props Sanjay Singh Jhala.
* Fix: Insights chart grouping by month was incorrect.
* Fix: Cron URL protocol mismatch could cause a http link to be included in the email report, even when the site url is https..
* Fix: Filter type issue breaking the filtering on the devices block, props Andrew.
* Fix: Duplicate key error in SQL hash update query.
* Fix: Email report logo centering and dark mode styling.
* Fix: A burst test hit could be used to bypass the built-in IP block, props Sanjay Singh Jhala.

= 3.2.3 =
* March 12th 2026
* Fix: share link for non logged in users not loading page.

= 3.2.1 =
* March 9th 2026
* Security fix: Fixed a missing authorization check that allowed users with Burst View privilege to manage reports. Props Sanjay Singh Jhala.
* Improvement: set turbo default to enabled, and add notice to recommend enabling it when cookieless tracking is enabled.
* Improvement: check if PharData class is installed on the server to prevent fatal errors.
* Fix: Store scheme for usage during cron jobs. During cron, the site_url is http. For the javascript generation, we need it to reflect the actual scheme, usually https.
* Fix: duplicate fields in the reporting settings when the share link is opened by an admin user.
* Fix: url not found warning when classic premium report is generated.
* Fix: too strict use of sanitizers causing table prefixes to get lowercase. props @parkentosh

= 3.2.0 =
* February 25rd 2026
* New: anonymously share data to help us improve Burst Statistics: build industry benchmarks, targeted feature development, and performance improvements.
* New: add notice about discord, inviting users to join our discord server.
* New: Easily share statistics with your team or clients, with the share button in the Burst Statistics dashboard.
* Fix: catch non json encoded data in Rest API tracking, props @rajkumarreddyv
* Fix: Bounce and bounce rate calculations now correctly count distinct bounced sessions instead of summing bounce flags, preventing inflated numbers.
* Fix: default value logic for 'merge variables and scripts' made it impossible to disable the setting.

= 3.1.6 =
* January 20th 2026
* Fix: deleting old data in archive functionality not working due to incorrect SQL syntax.
* Fix: Not filtering browser/OS data by device on the insights block, props @alisontaylorbc.
* Improvement: add automated test for data deletion.
* Improvement: add persistent sorting to datatable block, props @ankush.
* Improvement: filtering by continent.

= 3.1.5 =
* January 7th 2026
* Improvement: auto close notices in the right bottom of the screen.
* Improvement: some minor mobile responsiveness improvements.
* Improvement: extend automated tests with live visitors test.
* Improvement: wrapping of long URLs in live visitors view.
* Improvement: extended PHPCS coverage.
* Fix: when the browser's local storage is full, adding filters could cause an error.
* Fix: enforce https on combined variables and scripts URL, to prevent mixed content warnings.
* Fix: onboarding for RTL languages tried to load non existing RTL CSS file.

= 3.1.4 =
* December 23rd 2025
* Improvement: styling of datatable blocks and loading states.
* Improvement: referrer query performance improvements.
* Improvement: parameter query performance improvements.
* Improvement: exclude track hit over Rest Api from the Burst Rest Api Optimizer, this way all plugins are loaded during the hit, which is required for hook goals.
* Improvement: added fallback to default method for combine variables and scripts, in case the uploads directory is not writable.
* Improvement: the 'cron not running' notice not dismissible anymore, as it is a critical issue.
* Improvement: allow search for formatted data on datatables, e.g. you can now search for 'United States' instead of US on the locations datatable.
* Improvement: add parameter filtering.
* Fix: filtering on devices block.

= 3.1.0.3 =
* December 1st
* Fix: saving settings changes after saving initial changes required a reload.
* Performance: Performance improvements by offloading resource greedy processes during tracking to cron in batches
* Improvement: User Agent Parser improvements, removing invalid browsers
* Fix: dropdown for advanced filters not filtering the list.
* Fix: undefined tab caused by incomplete removal of sales menu when no WooCommerce or EDD detected.
* Fix: object caching on page counts causing slow update of page counts, props @fveits

= 3.0.2 =
* November 25th 2025
* Fix: some notices were incorrectly dismissed during validation.
* Improvement: added automated test for hook goals.
* Improvement: added automated test for archiving restoration.

= 3.0.0 =
* November 11th 2025
* Fix: compability with unknown plugin, allowing null value in get_timerange_dropdown() on WooCommerce products overview, props @tegid
* Fix: do not treat www and non www domains as different domains, when detecting multiple domains setup.
* Fix: remove obsolete slash in loading of goals script, which on some setups causes it to get blocked, props @jhndkrvzc
* Fix: top bar count did not show the 'k' for thousands, 'M' for millions, etc, only showing 1, instead of 1k.
* New: increase minimal required versions for PHP to 8.0, for WordPress to 6.4

== Upgrade notice ==
* Please backup before upgrading.

== Screenshots ==
1. Burst Statistics: Analytics Dashboard
1. Dashboard: Clean and easy-to-read overview
2. Insights: See exactly how your website performs
3. Sources: Analyze where your visitors come from (Burst Pro)
4. Settings: Simple options, no coding required.